chore: make sub claim mapping readonly after creation (#3306)

ui/admin/tests/acceptance/auth-methods/create-test.js

@@ -120,6 +120,9 @@ module('Acceptance | auth-methods | create', function (hooks) {
     );
     await click(selectors.FIELD_CLAIMS_SCOPES_ADD_BTN);
 
+    // Verify Account Claim Maps field is editable during creation
+    assert.dom(selectors.FIELD_ACCOUNT_CLAIM_MAPS).isNotDisabled();
+
     await fillIn(
       selectors.FIELD_ACCOUNT_CLAIM_MAPS_FROM_CLAIM,
       selectors.FIELD_ACCOUNT_CLAIM_MAPS_FROM_CLAIM_VALUE,

ui/admin/tests/acceptance/auth-methods/selectors.js

@@ -30,12 +30,13 @@ export const FIELD_CLAIMS_SCOPES_ADD_BTN =
   '[name=claims_scopes] [data-test-add-button]';
 export const FIELD_CLAIMS_SCOPES_DELETE_BTN =
   '[name=claims_scopes] [data-test-delete-button]';
+export const FIELD_ACCOUNT_CLAIM_MAPS = '[name=account_claim_maps]';
 export const FIELD_ACCOUNT_CLAIM_MAPS_FROM_CLAIM =
   '[name=account_claim_maps] [data-test-key-input]';
 export const FIELD_ACCOUNT_CLAIM_MAPS_FROM_CLAIM_VALUE = 'from_claim';
 export const FIELD_ACCOUNT_CLAIM_MAPS_TO_CLAIM =
   '[name=account_claim_maps] [data-test-value-select]';
-export const FIELD_ACCOUNT_CLAIM_MAPS_TO_CLAIM_VALUE = 'email';
+export const FIELD_ACCOUNT_CLAIM_MAPS_TO_CLAIM_VALUE = 'sub';
 export const FIELD_ACCOUNT_CLAIM_MAPS_DELETE_BTN =
   '[name=account_claim_maps] [data-test-delete-button]';
 export const FIELD_IDP_CERTS = '[name=idp_ca_certs] [data-test-value-input]';

ui/admin/tests/acceptance/auth-methods/update-test.js

@@ -169,14 +169,16 @@ module('Acceptance | auth-methods | update', function (hooks) {
       await click(element);
     }
 
-    await fillIn(
-      selectors.FIELD_ACCOUNT_CLAIM_MAPS_FROM_CLAIM,
-      selectors.FIELD_ACCOUNT_CLAIM_MAPS_FROM_CLAIM_VALUE,
-    );
-    await select(
-      selectors.FIELD_ACCOUNT_CLAIM_MAPS_TO_CLAIM,
-      selectors.FIELD_ACCOUNT_CLAIM_MAPS_TO_CLAIM_VALUE,
-    );
+    await fillIn(selectors.FIELD_ACCOUNT_CLAIM_MAPS_FROM_CLAIM, 'test_claim');
+
+    // Verify "sub" option is not available during update
+    await click(selectors.FIELD_ACCOUNT_CLAIM_MAPS_TO_CLAIM);
+    assert
+      .dom(`${selectors.FIELD_ACCOUNT_CLAIM_MAPS_TO_CLAIM} option[value="sub"]`)
+      .doesNotExist('"sub" option is not available during update');
+
+    // Select 'email' instead since 'sub' is not available
+    await select(selectors.FIELD_ACCOUNT_CLAIM_MAPS_TO_CLAIM, 'email');
 
     // Remove all certificates
     const certificatesList = findAll(selectors.FIELD_IDP_CERTS_DELETE_BTN);
@@ -223,7 +225,7 @@ module('Acceptance | auth-methods | update', function (hooks) {
       selectors.FIELD_CLAIMS_SCOPES_VALUE,
     ]);
     assert.deepEqual(authMethod.attributes.account_claim_maps, [
-      'from_claim=email',
+      'test_claim=email',
     ]);
     assert.deepEqual(authMethod.attributes.idp_ca_certs, [
       selectors.FIELD_IDP_CERTS_VALUE,
@@ -239,6 +241,62 @@ module('Acceptance | auth-methods | update', function (hooks) {
     assert.deepEqual(authMethod.attributes.prompts, ['none']);
   });
 
+  test('account claim maps field is disabled when sub mapping exists', async function (assert) {
+    setRunOptions({
+      rules: {
+        'color-contrast': {
+          // [ember-a11y-ignore]: axe rule "color-contrast" automatically ignored on 2026-06-02
+          enabled: false,
+        },
+      },
+    });
+
+    // Create OIDC auth method with a 'sub' mapping
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_OIDC,
+    });
+    instances.authMethod.attributes.account_claim_maps = ['username=sub'];
+
+    await visit(urls.authMethods);
+
+    await click(
+      commonSelectors.HREF(`${urls.authMethods}/${instances.authMethod.id}`),
+    );
+    await click(commonSelectors.EDIT_BTN);
+
+    assert.dom(selectors.FIELD_ACCOUNT_CLAIM_MAPS).isDisabled();
+  });
+
+  test('account claim maps field is editable when no sub mapping exists', async function (assert) {
+    setRunOptions({
+      rules: {
+        'color-contrast': {
+          // [ember-a11y-ignore]: axe rule "color-contrast" automatically ignored on 2026-06-02
+          enabled: false,
+        },
+      },
+    });
+
+    // Create OIDC auth method with email/name mappings (no 'sub')
+    instances.authMethod = this.server.create('auth-method', {
+      scope: instances.scopes.org,
+      type: TYPE_AUTH_METHOD_OIDC,
+    });
+    instances.authMethod.attributes.account_claim_maps = [
+      'username=email',
+      'fullname=name',
+    ];
+
+    await visit(urls.authMethods);
+    await click(
+      commonSelectors.HREF(`${urls.authMethods}/${instances.authMethod.id}`),
+    );
+    await click(commonSelectors.EDIT_BTN);
+
+    assert.dom(selectors.FIELD_ACCOUNT_CLAIM_MAPS).isNotDisabled();
+  });
+
   test('can update an ldap auth method and save changes', async function (assert) {
     setRunOptions({
       rules: {